Commit a4db5fe5 authored by J. Bruce Fields's avatar J. Bruce Fields Committed by Linus Torvalds

[PATCH] knfsd: nfsd4: fix memory leak on kmalloc failure in savemem

The wrong pointer is being kfree'd in savemem() when defer_free returns with
an error.
Signed-off-by: default avatarBenny Halevy <bhalevy@panasas.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 28e05dd8
...@@ -199,24 +199,22 @@ defer_free(struct nfsd4_compoundargs *argp, ...@@ -199,24 +199,22 @@ defer_free(struct nfsd4_compoundargs *argp,
static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes) static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes)
{ {
void *new = NULL;
if (p == argp->tmp) { if (p == argp->tmp) {
new = kmalloc(nbytes, GFP_KERNEL); p = kmalloc(nbytes, GFP_KERNEL);
if (!new) return NULL; if (!p)
p = new; return NULL;
memcpy(p, argp->tmp, nbytes); memcpy(p, argp->tmp, nbytes);
} else { } else {
BUG_ON(p != argp->tmpp); BUG_ON(p != argp->tmpp);
argp->tmpp = NULL; argp->tmpp = NULL;
} }
if (defer_free(argp, kfree, p)) { if (defer_free(argp, kfree, p)) {
kfree(new); kfree(p);
return NULL; return NULL;
} else } else
return (char *)p; return (char *)p;
} }
static __be32 static __be32
nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval) nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment